CVE-2022-39299

    Dashboard / Vulnerabilities / CVE-2022-39299

    CVE-2022-39299

    Published: 12 Oct 2022Last Modified: 12 Aug 2026

    Summary: Signature bypass via multiple root elements in Passport-SAML

    Details: Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.

    References: http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39299.json, https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7, https://nvd.nist.gov/vuln/detail/CVE-2022-39299, https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -8b6b2f28f1381f8d4f1476d5f962804e003c252a

    Affected versions

    v3.2.1
    v3.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39299 | CVE-DB